A Unified Framework for Security of the Software Supply Chain Can Prevent Disruptions, Event Hears

WASHINGTON, November 2, 2021 – The conversation on the security of the global supply chain should include the integrity of the software used to drive those products to market, and that will require leaders to align incentives to minimize risks of disruptions, an event heard Friday.

The supply chain is normally associated with the physical aspects of bringing products to consumers, including the facility, employees and management.

But panelists at an event held by the Commerce Department’s Bureau of Industry and Security Friday said there needs to be a security framework for the digital software supply chain as well.

Tom Quillin, who leads security and trust policy at Intel, said he supports a proposal by Google for a digital software supply chain security framework as a model for increasing the cohesiveness of the chain. Google’s proposal addresses risks to software systems that threaten the chain’s integrity and formalizes the criteria for its security, Quillin said.

Supply chain resiliency is critical to the Joe Biden Administration’s Build Back Better agenda. Aimed in part on improving U.S. economic competitiveness, structural weakness in the supply chain threatens national security, experts say.

The pandemic has wrought havoc on the global supply chain, which has seen shortages in things including routers, chips, and materials for fiber builds.

Aligning incentives to produce greater innovation

When asked about what the U.S. can do to promote wider adoption of integrity-boosting supply chain practices, Quillin said aligning incentives across the supply chain will help clarify the most important areas for future research and development. “Ensuring schedules and cost targets are met can lead to tradeoffs between security and trust,” Quillin said.

He said he thinks the U.S. should have a stronger focus on building incentives to ensuring security and trustworthiness amongst the supply chain. “With improved trust comes increased value to the consumer,” he said. “There are additional costs associated with transparency efforts, but the value added to the customer can cover the cost of added transparency.” Quillin believes that as the benefit of these solutions get built out, they become easier to implement and maintain over time.